# renew-coinbase.com — MALICIOUS

> Beware of renew-coinbase.com, an active phishing site targeting users. Stay vigilant and avoid sharing sensitive info on this domain.

## Summary
PhishDestroy identifies renew-coinbase.com as a medium-risk generic phishing threat actively targeting unsuspecting users. The domain impersonates legitimate financial services to deceive victims.

Evidence includes six security vendors flagging the domain on VirusTotal, and it resolves to IP 172.67.201.206. Registered recently in March 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED, its infrastructure suggests a potentially harmful campaign.

Users should avoid interacting with this domain and report suspicious activity. PhishDestroy continues monitoring renew-coinbase.com to provide timely alerts and help mitigate phishing risks.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 0)
- Target brand: Coinbase
- Page title: Sign in - Coinbase

## Domain Intelligence
- Registered: 2026-03-06 11:07:01
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 172.67.201.206
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: rohin.ns.cloudflare.com tina.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 6 vendors flagged
  Vendors: ["ADMINUSLabs", "alphaMountain.ai", "BitDefender", "CyRadar", "G-Data", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cc29a-dfd1-73a9-b157-f77f42a9722e.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/renew-coinbase.com
- Wayback Machine: https://web.archive.org/web/https://renew-coinbase.com
- PhishDestroy: https://phishdestroy.io/domain/renew-coinbase.com/
- LLM endpoint: https://phishdestroy.io/domain/renew-coinbase.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/renew-coinbase.com/
Last updated: 2026-03-19